Introduction
Six hundred and thirty million dollars. That is how much Elliptic says North Korea-linked launderers have moved through a handful of meme coins that cost about ninety dollars each to create. The stolen funds came from the $6.3 billion Binance hack on October 29, 2026. The launderers are not using mixers or privacy coins. They are minting throwaway tokens with names like FUK and SINU, pairing them with NEAR on decentralized exchanges, and trading stolen crypto through the pools until the trail looks like ordinary meme coin speculation. It is cheap, fast, and almost invisible to anyone watching the tokens themselves.
The Memecoin Laundry: How It Works
Step 1: Create a Throwaway Token
Creating a token on NEAR costs about 25 NEAR, roughly ninety dollars at the time of the operation. Between November 5 and November 7, the launderers created at least six tokens, including FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each token came with standard meme branding: a monkey in a pink bow, a duck in front of a US flag, an “Elon 2028 President” banner. The branding is not decorative. It is camouflage. A token that looks like a joke attracts less scrutiny than a token that looks like a laundering tool.
Step 2: Build a Liquidity Pool on a DEX
The launderers paired each new token with NEAR in a liquidity pool on a decentralized exchange. A liquidity pool is a smart contract that holds two assets and lets anyone trade between them. Because the pool sits between the buying and selling wallets, funds never move directly from one controlled wallet to another. One set of wallets buys the token with stolen NEAR. Another set, also controlled by the launderers, sells the token back into the pool and withdraws the paired NEAR. The pool absorbs the transaction, and the receiving wallet looks like a trader who simply sold a token at a profit.
Elliptic co-founder Tom Robinson described the tokens as “made to be used once and thrown away.” He added: “Nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set”. That control is the point. The launderers are not gambling on market demand. They are using the pool as a reversible pipe.
Why This Changes the Laundering Game
The Scale Is Tiny, But the Playbook Is Portable
About 117,000 NEAR, worth roughly $430,000, passed through the six NEAR tokens. That is a small fraction of the $6.3 billion hack. But the mechanism is not limited to NEAR. Elliptic found a similar disposable token on Tron and a different variant on Solana, where launderers swapped stolen SOL into existing, thinly traded tokens instead of minting new ones. The playbook adapts to whatever chain offers cheap token creation and a DEX with shallow liquidity. That portability is what makes it a bigger story than the dollar figure suggests.
DEXs Are the New Mixers
Traditional crypto mixers pool funds from many users and break the on-chain link between sender and receiver. Regulators have spent years pressuring mixers, and many now operate under sanctions or heavy compliance. The memecoin method achieves a similar goal without a mixer. The liquidity pool itself becomes the obfuscation layer. Investigators can still trace every transaction because the blockchain is public. But each swap adds work. Each new token adds a separate trail. Each liquidity pool forces analysts to reconstruct a sequence that was designed to look like unrelated trading activity.
The launderers also used a tactic that makes the tokens look organic: almost all trading came from wallets linked to the operation, and trading stopped as soon as the funds were moved. Outside activity was limited to a few small purchases of FUK on its first day. Five of the six token creators were funded by the same network. This is not a meme coin launch. It is a laundering script executed through meme coin infrastructure.
The Bigger Picture: $3 Billion Still Missing
Elliptic estimates that more than $3 billion in stolen Binance funds remains unlaundered. The memecoin operation is one channel, not the entire exit route. That remaining balance matters for two reasons.
First, the launderers have time. The Binance hack happened on October 29. The memecoin laundering began on November 5. That is a seven-day gap. The operation is still active, and the methods are evolving. The NEAR tokens are already a second-generation tactic. Elliptic first documented a similar approach after the 2025 Bybit hack, when at least $24 million moved through a worthless token created on Tron. The launderers are iterating.
Second, the remaining funds create pressure on every exchange and DEX that touches NEAR, Solana, or Tron. The stolen assets are traceable, but tracing is not the same as freezing. A DEX liquidity pool does not have a compliance department. It has code. Unless the front end or the pool is controlled by an entity that can block wallets, the trades execute. That is a structural gap, not a technical bug.
FAQ
What is memecoin laundering?
Memecoin laundering is the use of purpose-built or thinly traded meme tokens to move stolen crypto through liquidity pools so that funds do not travel directly between controlled wallets. The token acts as a disposable intermediary. The launderer buys the token with dirty funds, sells it through a separate wallet, and withdraws the paired asset.
How much of the Binance hack has been laundered this way?
Elliptic traced about 117,000 NEAR, worth roughly $430,000, through six meme tokens on the NEAR blockchain between November 5 and November 7, 2026. That is one channel. More than $3 billion in stolen funds remains unlaundered, and other channels are likely active.
Why use memecoins instead of a mixer?
Mixers are heavily monitored and increasingly sanctioned. Memecoins and DEX liquidity pools are not. Creating a token costs about $90 on NEAR. The pool provides a legitimate-looking trading venue. The launderer controls both sides of the trade, so price discovery is irrelevant. The goal is not profit; it is a credible-looking transaction history.
Can law enforcement trace these transactions?
Yes. Every swap is on-chain. Elliptic and other analytics firms have already mapped the NEAR operation. The challenge is not visibility but volume and fragmentation. Each new token and each new pool creates additional reconstruction work. The method does not make funds invisible. It makes them slower and more expensive to trace.
What can exchanges do about this?
Exchanges can screen for wallets that interact with newly created tokens that have no organic trading history. They can flag liquidity pools where almost all activity comes from a small cluster of wallets. They can also share intelligence faster after a major hack. The harder problem is DEXs: a decentralized exchange has no central compliance team. Oversight of token creation and pool deployment remains an open regulatory question.
Is this connected to the Bybit hack?
Yes. Elliptic says the same North Korea-linked network used a similar disposable-token technique after the 2025 Bybit hack, moving at least $24 million through a worthless token on Tron. The Binance operation is a continuation and an expansion of that playbook.
Conclusion
The memecoin is not a joke anymore. It is a laundering instrument, and it is cheap enough to use at scale. North Korea-linked launderers have shown that you do not need a mixer, a privacy coin, or a sophisticated smart contract exploit to move stolen crypto. You need a ninety-dollar token, a liquidity pool, and two wallets. The $430,000 traced through NEAR is a proof of concept. The $3 billion still sitting in stolen funds is the real test.
The uncomfortable question for anyone holding meme coins is not whether the token has utility. It is whether the liquidity pool you are trading in was built for people like you, or for people who need to move money without moving it directly. If a token’s entire trading history comes from a handful of wallets and stops the moment the funds are gone, you are not early. You are the cover.
What is the strangest “utility” you have seen a meme coin claim, and did the on-chain activity actually match the story?
Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice. It discusses criminal activity and blockchain analytics. Always conduct your own research before interacting with any token or liquidity pool.
